Improving License Compliance for Software Development

提高软件开发的许可合规性

• 批准号: RGPIN-2016-04105
• 负责人: German, Daniel
• 金额: $ 2.77万
• 依托单位: University of Victoria
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2020
• 资助国家: 加拿大
• 起止时间: 2020-01-01 至 2021-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=708844
• 关键词: Improving; License; Compliance; Software; Development

Free and Open Source Software (FOSS) is widely reused in industry. Broadly speaking, FOSS is software under a license that allows for its reuse and the creation of derivative works under a set of conditions. While reusing FOSS usually involves no monetary transaction, the organization reusing the software must comply with the conditions set by its license in order to have the right to reuse and redistribute the software. Current licensing analysis assumes a one-size-fits-all model. It presumes that the legal constraints of building a system are universal and only need to be considered once. However, this is usually not the case due to a variety of legal and technical reasons: (a) the law regarding software varies across jurisdictions; (b) the legal constraints regarding software development are often ambiguous or untested and subject to interpretation; (c) many FOSS packages offer the ability to configure the build process in order to customize what parts of the systems are builtas a consequence, different "builds" of the same source code might have different legal constraints; and (d) FOSS provenance information is difficult to determineFOSS is often copied, renamed, moved, and it is not always easy to see where code originated, who the true copyright owner is, and when and how the code was copied into another system. The goal of this proposed research is to address these issues and create models and tools to assist developers and legal teams with license compliance. In particular, this grant will support the following research goals: 1. Perform empirical studies to understand the challenges of organizations wanting to reuse licensed components. 2. Develop a model and method that formalizes the evaluation of licensing compliance for software and a prototype to demonstrate its feasibility. 3. Develop methods and techniques to improve the discovery, traceability and management of the provenance of software artifacts, as well as build tools that implement them. The management of license requirements of reusable components is a critical problem of industry for which there is a lack of research. The studies, models, methods and tools we propose will address this problem and will help industry improve its productivity by reducing the cost of the reuse of licensed components.

免费开源软件（FOSS）在行业中被广泛重复使用。从广义上讲，FOSS是根据许可证的软件，可重用，并在一组条件下创建衍生作品。虽然重复使用FOSS通常不涉及货币交易，但组织重用该软件必须遵守其许可证设定的条件，以便有权重新使用和重新分配软件。 当前的许可分析假定一个尺寸合适的模型。它假定构建系统的法律限制是普遍的，只需要一次考虑一次即可。但是，由于各种法律和技术原因，通常情况并非如此：（a）有关软件的法律在各个司法管辖区的不同； （b）有关软件开发的法律限制通常是模棱两可的或未经测试的，并且要进行解释； （c）许多FOSS软件包提供了配置构建过程的能力，以自定义系统的构建部分，结果是同一源代码的不同“构建”可能具有不同的法律约束； （d）很难确定FOSS出处信息经常被复制，重命名，移动，并且并不总是很容易看到代码的起源，真正的版权所有者是谁以及何时以及如何将代码复制到另一个系统中。 这项拟议的研究的目的是解决这些问题，并创建模型和工具，以协助开发人员和法律团队遵守许可证。特别是，该赠款将支持以下研究目标： 1.进行经验研究，以了解想要重复使用许可组件的组织的挑战。 2。开发一种模型和方法，该模型和方法正式评估软件的许可合规性和一个原型以证明其可行性。 3。开发方法和技术来改善软件工件出处的发现，可追溯性和管理，并构建实施它们的工具。 可重复使用组件的许可要求的管理是一个关键的行业问题，缺乏研究。我们提出的研究，模型，方法和工具将解决此问题，并通过降低许可组件的再利用成本来帮助行业提高其生产率。